轉發 國家資安資訊分享與分析中心 資安訊息警訊 NISAC-200-202602-00000091

[內容說明]
研究人員發現Notepad++存在更新完整性驗證不足(Insufficient Update Integrity Verification)漏洞(CVE-2025-15556)，未經身分鑑別之遠端攻擊者可於使用者更新Notepad++程式時，誤導安裝程式至惡意伺服器下載並執行惡意程式，該漏洞已遭駭客利用，請儘速確認並進行修補。

[影響平台]
Notepad++ 8.8.9(含)以前版本

[建議措施]
切勿使用自動更新，請至官網下載更新程式並手動安裝： https://notepad-plus-plus.org/downloads/v8.9.1/

[參考資料]
1. https://notepad-plus-plus.org/news/hijacked-incident-info-update/
2. https://notepad-plus-plus.org/downloads/v8.9.1/
3. https://nvd.nist.gov/vuln/detail/CVE-2025-15556
Forwarded from the National Cybersecurity Information Sharing and Analysis Center: Cybersecurity Alert NISAC-200-202602-00000091

[Content Description]
Researchers have discovered a vulnerability in Notepad++ called Insufficient Update Integrity Verification (CVE-2025-15556). An unauthenticated remote attacker could mislead the installation process when a user updates Notepad++, causing the program to be downloaded to a malicious server and executed. This vulnerability has already been exploited by hackers; please confirm and patch it as soon as possible.

[Affected Platforms]
Notepad++ versions 8.8.9 and earlier

[Recommended Measures]
Do not use automatic updates. Please download the update program from the official website and install it manually: https://notepad-plus-plus.org/downloads/v8.9.1/

[References]
1. https://notepad-plus-plus.org/news/hijacked-incident-info-update/
2. https://notepad-plus-plus.org/downloads/v8.9.1/
3. https://nvd.nist.gov/vuln/detail/CVE-2025-15556